ROMTableScan

From SEGGER Wiki
Jump to: navigation, search

For ARM CoreSight based systems, by default J-Link will scan the ROM table (and nested ones) to find CoreSight components like for example:

  • The core debug registers
  • An Embedded Trace Macrocell (ETM)
  • A Cross Trigger Interface (CTI)

Cortex-A specifics

In contrast to Cortex-M where the core debug registers base address is fixed, for Cortex-A/R the location of all CoreSight components is configurable for the silicon vendor. As the base address of the core debug registers must be known to J-Link in order to be able to debug, J-Link will scan the top-level ROM table and nested ones until a matching Cortex-A/R core is found.

J-Link will stop the scan as soon as a matching core has been found and will not continue to scan the remaining entries of the ROM table. This is because (especially in multi-core environments) there may be other cores, ETMs, etc. that are not clocked by default (after reset) and accessing their PID, CID, DEVARCH, DEVTYPE CoreSight registers in order to identify type of the CoreSight component may put the DAP into a hanging state where it becomes unresponsive to further commands. This state (depending on the MCU) may only recoverable by a power-cycle of the MCU.

The core that executes the boot code after reset is clocked after reset and is usually also the first one that is found in the ROM table. So stopping at the first matching core minimizes the risk to access inaccessible CoreSight components by accident and gives a better out-of-the-box experience for users.

Example layout of ROM table:

ROMTbl[0][0]: ROMTbl1
ROMTbl[0][1]: Something (not clocked)
ROMTbl[0][2]: Something (not clocked)

ROMTbl[1][0]: Cortex-A53_0 (main core, clocked)
ROMTbl[1][1]: CTI-A53_0 (clocked)
ROMTbl[1][2]: ETM-A53_0 (clocked)
ROMTbl[1][3]: Cortex-A53_1 (secondary core, not clocked)
ROMTbl[1][4]: CTI-A53_1 (secondary core, not clocked)
ROMTbl[1][5]: ETM-A53_1 (secondary core, not clocked)

ROM table scan will stop at: ROMTbl[1][0]: Cortex-A53_0

Note:
The user may set the core debug registers base address manually (e.g. via a J-Link script file). Doing so will skip the ROM table scan.
Note:
To skip the ROM table scan on ARMv8-AR targets, the user needs to set both the core debug registers base address as well as the CTI base address. See the S32V234 script on J-Link Script Files for an example.

Cortex-R specifics

See section Cortex-A specifics

Cortex-M specifics

While the core debug registers base address is fixed for Cortex-M based systems, there are still MCU-optional CoreSight components that may be present. J-Link by default will scan the top-level ROM table and nested ones until the end of each ROM table is reached (0x0 entry).